Cyber Attack Task Force - Final Report - NERC

Recommendations
Following are the recommendations from the task force:
Recommendations
• Continue to build on the Attack Trees - A significant amount of work has gone into creating
the attack tree framework, however recommendations from detailed analysis have not
been completed. The top level root node of the attack tree is very specific to the task force
scope, but lower level branches are applicable to many other scenarios such as attacks on
generation, transmission/distribution or disrupting situational awareness.
A separate working group under NERC’s Critical Infrastructure Protection Committee (CIPC)
should be established to further develop attack trees with the goal of populating the nodes,
performing detailed analysis and providing recommendations to industry from this analysis.
While these trees will never be finished, they do provide a solid structure to build on. For
example, for each revision to the CIP standards the new requirements could be
incorporated into the attack trees and analysis rerun to determine any positive or negative
consequences of the propose changes. Prior to release of a NERC Alert, compare mitigation
measure actions against the attack trees to determine if the recommendations provide the
greatest likelihood of reducing the potential for compromise. At least annually evaluate the
attack trees to incorporate new information.
Because of the sensitive information captured and developed, the attack trees should be
stored and managed as part of the NERC ES-ISAC documentation library, or in some cases,
on classified systems.
Cyber Attack Task Force Report 33